Thanks, can you provide the preloader, or dump it if you are root or have adb access:
# Check eMMC boot partitions are exposed
adb shell ls /dev/block/mmcblk0boot0
adb shell ls /dev/block/mmcblk0boot1
# Unlock read (boot partitions are force-RO by kernel by default)
adb shell "echo 0 > /sys/block/mmcblk0boot0/force_ro"
# Dump it
adb shell "dd if=/dev/block/mmcblk0boot0 of=/sdcard/preloader_dump.bin bs=512"
# Pull to hostadb pull /sdcard/preloader_dump.bin
If boot0 comes up empty
Try this: Some MTK configs store preloader on the
main eMMC at a fixed offset instead:
adb shell "dd if=/dev/block/mmcblk0 of=/sdcard/preloader_dump.bin bs=512 skip=0 count=2048"
Verify it's actually the preloader
strings preloader_dump.bin | grep -i "preloader\|MTK\|BROM"
# Should see MTK magic headers
xxd preloader_dump.bin | head -4
# MTK preloader magic: 88 16 88 58
Thanks